Skip to content

3.11.0 Security Maintenance Fixes & Minor Features

Choose a tag to compare

View all tags
@daggerhart daggerhart released this 12 Feb 12:58
· 9 commits to develop since this release
3.11.0
a45435f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release 3.11.0 - Security Release

🔒 CRITICAL SECURITY UPDATE - Upgrade Immediately

Overview

Version 3.11.0 addresses multiple authentication security vulnerabilities, including critical issues that could allow authentication bypass. This release adds comprehensive JWT signature verification and SSRF protection.

All users should upgrade immediately and configure the JWKS endpoint.

Security Fixes

Critical Issues

1. JWT Signature Verification Implemented

  • Previous versions decoded JWT tokens without cryptographic verification
  • Added proper JWT signature verification using JWKS (JSON Web Key Set)
  • Implements firebase/php-jwt library for validation
  • Validates all required claims: exp, aud, iss, iat, sub
  • Action Required: Configure JWKS endpoint (see Configuration below)

2. Aggregated Claims JWT Verification

  • Added signature verification for aggregated claims from secondary JWTs
  • Prevents injection of forged claims

3. SSRF Protection Added

  • Replaced unsafe HTTP functions with SSRF-protected alternatives
  • Added allow_internal_idp setting for legitimate internal identity providers
  • Secure by default (disabled)
  • Enable only for local development or corporate internal IDPs

High Priority Issues

4. Weak State Generation Fixed

  • Replaced non-cryptographic mt_rand() with secure random_bytes()
  • State values now cryptographically secure

5. Open Redirect Vulnerability Fixed

  • Added wp_validate_redirect() to redirect handling
  • External redirects now blocked by default

6. SSL Verification Bypass Restricted

  • SSL bypass now only works in local development environments
  • Requires WP_DEBUG=true and WP_ENVIRONMENT_TYPE=local
  • Automatically disabled in production

7. Debug Mode Removed

  • Removed debug mode that could expose sensitive settings

Configuration Required

JWKS Endpoint Setup (Required for Full Protection)

  1. Navigate to: Settings → OpenID Connect Client
  2. Find the JWKS URI field
  3. Enter your identity provider's JWKS endpoint
  4. Test authentication

Common JWKS Endpoints

Keycloak:

https://{domain}/realms/{realm}/protocol/openid-connect/certs

Auth0:

https://{domain}/.well-known/jwks.json

Okta:

https://{domain}/oauth2/default/v1/keys

Azure AD:

https://login.microsoftonline.com/{tenant}/discovery/v2.0/keys

Google:

https://www.googleapis.com/oauth2/v3/certs

Generic OpenID Connect:
Check your IDP's discovery document at:

https://{domain}/.well-known/openid-configuration

Look for the jwks_uri field.

New Settings

1. JWKS URI - Identity provider's JWKS endpoint URL

  • Location: Settings → OpenID Connect Client
  • Environment variable: OIDC_ENDPOINT_JWKS_URL

2. JWKS Cache TTL - Cache duration for JWKS keys (default: 1 hour)

3. Allow Internal IDP - Enable requests to internal network endpoints

  • Default: Disabled (secure)
  • Enable only for local development or internal corporate IDPs
  • Warning: Only enable if you understand the security implications

Backwards Compatibility

Sites without JWKS configured will continue to work but remain vulnerable.

Migration Path:

  1. Upgrade to 3.11.0
  2. Configure JWKS endpoint
  3. Test authentication
  4. Verify no security warnings in logs

Security warnings will be logged if JWKS is not configured, helping you identify sites that need migration.

What's Changed

New Files

  • includes/openid-connect-generic-jwt-validator.php - JWT validation class

Modified Files

  • includes/openid-connect-generic-client.php - JWT verification, SSRF protection, secure state generation
  • includes/openid-connect-generic-client-wrapper.php - Aggregated claims verification, redirect validation, SSL restrictions
  • includes/openid-connect-generic-settings-page.php - Debug mode removal, new settings, SSRF protection
  • includes/openid-connect-generic-jwt-validator.php - SSRF protection
  • openid-connect-generic.php - Settings initialization
  • composer.json - Added firebase/php-jwt dependency
  • tests/ - Updated unit tests

New Dependencies

  • firebase/php-jwt: ^6.10 - Industry-standard JWT validation library

Performance Impact

Minimal impact on authentication:

  • First authentication: Fetches JWKS from IDP (~200ms)
  • Subsequent authentications: Uses cached keys (~5ms)
  • Default cache: 1 hour (configurable)

Troubleshooting

Authentication fails after upgrade:

  • Verify JWKS endpoint is correct and accessible
  • Check plugin logs for specific error messages
  • Test JWKS endpoint: curl https://your-idp/.well-known/jwks.json

Security warnings in logs:

  • Configure JWKS endpoint to resolve warnings
  • Enable logging in Settings → OpenID Connect Client

"Invalid audience" error:

  • Verify Client ID matches IDP configuration

"Invalid issuer" error:

  • Verify Login Endpoint URL matches IDP issuer

Upgrade Instructions

Via WordPress Admin:

  1. Backup your site first
  2. Go to Plugins → Installed Plugins
  3. Find OpenID Connect Generic
  4. Click Update Now
  5. Configure JWKS endpoint

Via Composer:

composer update daggerhart/openid-connect-generic

Rollback

If you encounter issues, you can temporarily rollback to 3.10.4:

composer require daggerhart/openid-connect-generic:3.10.4

Note: Rolling back leaves vulnerabilities unfixed. Only rollback temporarily while resolving configuration issues.

Support

Credits

  • Development Team: Jonathan Daggerhart
  • Security Research Community: Thank you for responsible disclosure
Assets 2
Loading